feat: datacap direct mode (in-process sidecar replacement)

[myleshorton]

Summary

• Moves datacap sidecar logic in-process as an optional DeviceUsageStore for VPS deployments
• Introduces DataCapAPI / ReportSink interfaces to decouple connection tracking from backend (HTTP sidecar vs gRPC direct)
• Extracts reportingCore from conn.go / packet_conn.go eliminating ~150 lines of duplication
• Adds mTLS client credentials for gRPC auth with CA-verified server cert
• Local proto types in dcpb/ mirror lantern-cloud's DataCapService to avoid cross-repo dependency
• Multi-region OCI packer builds (iad, fra, nrt, sin)

Both modes coexist: --datacap-url (legacy sidecar) and --datacap-grpc-api (new direct) are mutually exclusive flags.

Companion PR: lantern-cloud feat/datacap-direct-mode (mTLS listener + VPS cert provisioning)

Test plan

• go build ./... passes
• go test -race ./tracker/datacap/... passes (10 new tests for DeviceUsageStore)
• Integration test with mock gRPC server
• Deploy to test proxy, verify datacap tracking without sidecar container
• Verify sidecar mode (--datacap-url) still works unchanged

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds a “direct mode” datacap reporting path that runs aggregation + batch upload in-process (via gRPC to the cloud API), while preserving the existing “sidecar over HTTP” legacy mode. It also expands OCI image builds to multiple regions.

Changes:

• Refactor datacap connection reporting to use a ReportSink abstraction shared by HTTP sidecar and the new in-process store.
• Add DeviceUsageStore (direct mode) with background batching, sync, and a gRPC-backed DataCapAPI implementation.
• Update CLI flags and image build automation to support direct-mode configuration and multi-region OCI images.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tracker/datacap/tracker.go	Tracker now targets a ReportSink and adds direct-mode lifecycle wiring.
tracker/datacap/reporting.go	New shared reporting/throttling core used by both Conn and PacketConn.
tracker/datacap/conn.go	Conn refactored to embed reportingCore and report via ReportSink.
tracker/datacap/packet_conn.go	PacketConn refactored similarly to Conn using reportingCore.
tracker/datacap/api.go	Introduces ReportSink and DataCapAPI abstractions + DTOs for batching/sync.
tracker/datacap/client.go	HTTP client now implements ReportSink via Report().
tracker/datacap/device_store.go	New in-process store implementing ReportSink, batching uploads + syncing state.
tracker/datacap/device_store_test.go	Unit tests for store batching, sync behavior, concurrency, and shutdown.
tracker/datacap/integration_test.go	Updates tests to use Sink instead of Client in configs.
tracker/datacap/dcpb/datacap.proto	New proto mirroring lantern-cloud DataCapService for isolated dependency.
tracker/datacap/dcpb/datacap.pb.go	Generated protobuf types for datacap service.
tracker/datacap/dcpb/datacap_grpc.pb.go	Generated gRPC client/server interfaces for datacap service.
cmd/grpc_datacap.go	gRPC DataCapAPI implementation + TLS/mTLS connection helper.
cmd/cmd_run.go	Adds direct-mode CLI flags and wiring; enforces mode exclusivity.
deploy/packer/lantern-box.pkr.hcl	Splits OCI builds into per-region sources with region-specific subnet/AD vars.
.github/workflows/build-images.yaml	Updates workflow inputs, OCI env vars, manifest parsing, and Vault updates per region.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.